Privacy and cookies

Who I am

HeadForCode is me, Nick Lewis, an independent web developer and technology consultant in Reading. I work as a sole trader, so I’m responsible for the personal data described here (the “data controller”).

If you have any question about your data, email me at info@headforcode.com.

What I collect, and why

• When you use the contact form: your name, email address, subject and message, and how you heard about me if you choose to say. I use them to reply, and I keep them in my client records so I know what we discussed. The legal basis is my legitimate interest in answering enquiries (a genuine business reason to use your details, which I’ve weighed against your privacy), or, if you’re asking about work, the steps before we agree a contract.
• When you use the free website check: the check looks only at the website address you give it: that site’s home page, its robots.txt and its sitemap.xml. It follows the site’s own redirects (for example, to its www address), and also tries the plain http:// address to see whether it sends visitors to the secure https:// one. To stop the check being misused, each check records the site’s domain and a one-way hash of your IP address (a code made from it, not the address itself), and these are deleted after 30 days. The legal basis for that is my legitimate interest in keeping the check working and stopping abuse. You don’t have to give an email address, and there are two separate boxes you can tick: one to have the report emailed, and one to let me follow up. If you tick either, nothing is emailed and nothing goes into my records straight away. First I send one short email (by Resend) to check the address is yours, with a link to a page where you press a button to confirm. The record of the check keeps a one-way, keyed hash of your email address, so I send at most one of these a day to each address. The link works for 48 hours. If you don’t confirm, your email address and the report are deleted within 3 days. When you press the button, I record a one-way hash of your IP address, so the button can’t be pressed too often; that record is deleted at the first daily clean-up after it’s a day old. Once you confirm, if you asked for the report, I email it to you (sent by Resend) and don’t keep your email address: the record keeps only the one-way, keyed hash of it. If you asked me to follow up, I keep your email address in my client records as an enquiry from the website check, with the address you checked and a short summary of the report, and I may email you once to ask whether you’d like help. I won’t email you again unless you reply. The hash is deleted with the record after 30 days. The legal basis for each is your consent, given separately, and you can withdraw either at any time by replying to me or emailing me.
• When you join the HeadForCode Learn waitlist: your email address, your first name if you give it, and the topics you tick. I use them to send you one email when it launches, and I won’t email you about anything else. The legal basis is your consent, which you can withdraw at any time by replying to me or emailing me.
• When you’re a client: your contact details and what we need for the work. The legal basis is our contract, and I keep invoices and the records behind them because tax law requires it.
• Case studies and testimonials: with a client’s permission, I write up the work we did together, and may quote them by name and role. I only publish a quote with the person’s written agreement, and I’ll take it down if they ask.
• When I’m looking for work: recruiters’ and employers’ names and contact details, from job adverts and our messages, and my notes on each application. The legal basis is my legitimate interest in finding work.
• Businesses I might work with: I research local organisations that might need my help. I find them on OpenStreetMap and then look at their own websites, and I keep what they publish: the business name, website and published contact details. The legal basis is my legitimate interest in offering my services. If you’d rather I didn’t contact you or keep your details, tell me and I’ll delete them. I never sell them or pass them on for anyone else’s use.
• When you visit the site: my host, Netlify, keeps request logs, including IP addresses, to run the site and keep it secure. I don’t use them to identify or track you.

I don’t use analytics, advertising or tracking of any kind, and I don’t sell or rent anyone’s data.

Who else handles it

A few services help me run the site and my business. They act on my instructions and may not use your data for their own purposes:

• Netlify hosts the site and stores form submissions, my database and uploaded files.
• Resend sends my emails.
• Google hosts my email, so enquiries and our emails are kept in my mailbox there.
• Anthropic provides the AI assistants that help me keep on top of enquiries and follow-ups. They can read my client and contact records, including enquiries, my notes and waitlist sign-ups, but only to work for me.

These companies process data in the United States, and my database is in the US too. Each one’s data processing terms cover transfers from the UK: Netlify, Resend and Anthropic use the Information Commissioner’s International Data Transfer Addendum to the standard contractual clauses, and Google uses the UK–US data bridge and standard contractual clauses (checked 13 November 2026).

Some pages also load things straight from other services, which then see your IP address: the page of my Hive blog posts shows each post’s image from wherever it’s hosted, usually Hive’s image servers; and a HeadForCode Learn lesson with a video shows its thumbnail from YouTube’s image server, which sets no cookies, while the video itself loads from YouTube only when you press play.

How long I keep it

• Enquiries and contacts: 2 years after we were last in touch, unless you become a client.
• Clients: 6 years after the end of the tax year in which we were last in touch, for tax records.
• Website checks: the domain checked, the hash of your IP address and, if you ticked either box, the hash of your email address are deleted after 30 days. If you ticked a box but didn’t confirm, your email address and the report are deleted within 3 days. If you confirmed that I may follow up, your enquiry is kept like any other.
• The HeadForCode Learn waitlist: deleted 3 months after the launch email.
• Recruiters and employers from my job search: 2 years after the application was last updated.
• Businesses I’ve researched: 2 years after I last looked at or contacted them, or straight away if you ask.

Your rights

You can ask me for a copy of the data I hold about you, and ask me to correct it, delete it, stop using it or restrict how I use it, or to send it to you in a form you can take elsewhere. Where you gave consent, you can withdraw it at any time. Email me at info@headforcode.com and I’ll reply within a month.

If you’re unhappy with how I’ve handled your data, please tell me first. You also have the right to complain to the Information Commissioner’s Office (ICO).

Complain to the ICO

Cookies

This site sets no cookies for visitors. There are no analytics, advertising or tracking cookies, and nothing is stored in your browser.

The only cookie is for me: it keeps me signed in to the site’s admin. It’s strictly necessary for that, so it doesn’t need consent. It’s only set when someone signs in to the admin, or tries to, and never when you read the site’s pages.

A HeadForCode Learn lesson video shows only a thumbnail until you press play. Once you do, the video comes from YouTube’s privacy-enhanced service (youtube-nocookie.com), which may set cookies of its own.

That’s why there’s no cookie banner: there’s nothing to ask about. If that changes, I’ll update this page and ask for your consent first.

Changes to this notice

If I change how I handle personal data, I’ll update this page and the date at the top.